Dual-Locking Learned AI Models: A PIN-Based Sparse QIM Watermarking and Adaptive Index Permutation Approach
Authors: Iva Vasic, Jesús Muñoz-Cádiz, Bata Vasic
Organizations: Faculty of Science and Medicine, University of Fribourg, 1700 Fribourg, Switzerland · Faculty of Electronic Engineering, University of Nis, 18000 Nis, Serbia · Information Technology Department, University MB, 11040 Belgrade, Serbia
We present a dual-locking method for securing trained neural networks that combines key-driven index permutation with PIN-based watermarking based on Sparse Quantization Index Modulation (QIM). Cryptographic randomness is introduced by independently applying a uniform random permutation to each row of adaptively selected index vectors. A robust blind binary watermark is then embedded into the bias coefficients by modulating their quantized values, binding the network to a user-defined Personal Identification Number (PIN). Without the correct key, the network retains its architecture but becomes functionally impaired due to disrupted internal representations. Inverse permutation fully restores the original model accuracy, while the embedded watermark remains imperceptible and enables blind verification of key association and model authorship. To improve both locking effectiveness and recoverability, an adaptive key selection strategy redistributes high-magnitude weights to low-sensitivity positions and vice versa, increasing degradation in the locked state while preserving full recovery. Experiments on MNIST, CIFAR-10/100, and ImageNet-1K using fully connected networks, ResNet CNNs, and transformer architectures show that locking reduces accuracy below 10%, and even below 0.5% for CNNs, while the correct key fully restores performance. The watermark introduces no measurable accuracy degradation and reliably authenticates ownership. Analysis of embedding distributions across CNNs and transformers further indicates potential diagnostic value for identifying undertrained or suboptimally designed models. The proposed approach therefore provides simultaneous model protection, recovery, and ownership verification.
Figures & tables
Fig. 1: Illustration of the proposed locking and unlocking mechanism, where the function ℵ(W,b) maps the weight vector W and bias vector b , while the permutation operator πK and its inverse πK−1 are defined in ( 5 ) and ( 8 ), respectively. The central part of the illustration depicts Stage 1, representing the key-based adaptive permutation, and Stage 2, corresponding to the PIN QIM watermarking process.
Fig. 2: Accuracy degradation curves for all neural networks (NN1–NN6) as a function of key length r under random reshuffling of bias indices ( 7 ).
NN Name
Accuracy as a function of key length
Original
4
10
100
1000
10000
NNetwork1
96.48%
74.29%
50.65%
9.89%
8.95%
8.14%
NNetwork2
95.04%
94.92%
94.61%
84.99%
16.16%
9.53%
NNetwork3
96.21%
95.80%
94.96%
38.64%
11.45%
10.79%
ResNet18
70.59%
0.93%
0.45%
0.03%
0.19%
0.00%
ResNet20
92.12%
53.03%
30.80%
9.80%
9.88%
10.00%
TABLE I: Accuracy of adaptive locked Neural Networks
Fig. 3: Accuracy degradation curves for all neural networks (NN1–NN6) as a function of key length r ( 9 ) under adaptive permutation of weight indices in descending-order index vector L defined in ( 8 ).
NN Name
Accuracy as a function of PIN Length
Original
4
6
8
NNetwork1
96.48%
96.46%
96.47%
96.47%
NNetwork2
95.04%
95.03%
95.07%
95.03%
NNetwork3
96.21%
96.20%
96.23%
96.21%
ResNet18
70.59%
68.83%
68.93%
68.74%
ResNet20
92.12%
91.31%
90.82%
90.52%
TABLE II: Accuracy of watermarked Neural Networks
LLM
Watermarked Accuracy for different key lengths
Original
1000
10000
15000
ALBERT
92.66
88.88
56.77
50.11
BERT-Tiny
70.59
59.06
63.65
48.97
DistilBERT
91.06
85.89
60.21
49.08
MiniLM
90.14
86.70
59.63
50.23
TABLE III: Accuracy of watermarked LLMs
Attacks
Level 1
Level 2
Model usability
Dual-Locking robustness
Post-lock fine-tuning
Yes
Yes
No
Yes
Model distillation
No
No
No
No
Pruning and compression
No
Yes
No
Yes
Weight reinitialization
Yes
No
No
Yes
Overwriting or forging
Yes
No
Yes
Yes
Key-search or brute-force
Yes
Yes
Yes
Yes
TABLE IV: Dual-locking robustness of each protection level
Fig. 4: Histogram of absolute bias variations ∣Δb∣ across all Sparse QIM T -blocks for the intensive fine-tuning configuration ( p2_approx4x ).
Fig. 5: Accuracy degradation curves for all neural networks (NN1–NN6) as a function of key length r under random reshuffling of weight indices ( 6 ). The X-axis is represented using a base- 10 logarithmic scale of r , where the value r=0 effectively corresponds to the performance of the original networks.
NN Name
Locked NN Accuracy for different key lengths
Original
10
100
>100
B_NNetwork1
96.48%
96.26%
95.98%
95.47%
B_NNetwork2
95.04%
95.02%
95.06%
93.44%
B_NNetwork3
96.21%
96.24%
95.84%
94.86%
ResNet18
70.59%
52.96%
0.42%
0.38%
ResNet20
92.12%
75.31%
10.04%
10.00%
I.TABLE: Accuracy of Neural Networks
NN Name
Locked NN Accuracy for different key lengths
Original
10
100
>100
B_NNetwork1
96.48%
94.38%
95.10%
96.48%
B_NNetwork2
95.04%
94.49%
90.82%
95.04%
B_NNetwork3
96.21%
95.68%
93.58%
96.21%
ResNet18
70.59%
0.16%
0.06%
0.22%
ResNet20
92.12%
9.63%
10.15%
10.00%
II.TABLE: Accuracy of Neural Networks: adaptive locked biases
The quality of open-weight language models has dramatically improved in recent years. Sharing weights greatly facilitates model adoption by enabling their use across diverse hardware and software platforms. They also allow for more open research and testing, to the extent that users can use them as checkpoints, fine-tune them according to their needs, and potentially redistribute them. In some cases, however, concerns on modifying these weights towards unauthorized uses may outweigh the pros of giving users such freedom. Defending against such adaptation is non-trivial: since an adaptive attacker can observe all weights and architectures by definition, they can reverse simple structural defenses, and use optimization to defeat the simplest locking mechanisms. In this work, we exploit the inference-training asymmetry of automatic differentiation as a novel defense axis. We propose DLR-Lock, a method where the purveyor of the model purposely replaces each pretrained MLP in their model with a deep low-rank residual network (DLR-Net) of comparable parameter count, forcing activation memory that grows linearly with depth during backpropagation. DLR-Nets are efficiently trained via module-wise regression. We show that, beyond this memory overhead, DLR-Lock results in architectural mismatches that complicate the optimization landscape of standard fine-tuning, and a backward pass that incurs disproportionately more overhead than the forward pass. Our defense succeeds in withstanding adaptive attackers with full knowledge of the defense strategy while preserving the original model's capabilities. Experiments on LLMs validate these claims.
Keitaro Sakamoto, Pierre Ablin, Federico Danieli +1
Hyperdimensional computing (HDC) offers efficient learning and inference for resource-constrained systems, yet ownership verification of its models remains underexplored. We present the first systematic investigation of model watermarking in HDC by adapting backdoor-based embedding to three classifiers with different prototype-learning mechanisms. Across four benchmarks, with conventional neural networks as references, we examine whether watermarks can be learned without compromising task accuracy and whether they survive subsequent model modification and replication. The error-driven classifiers, AdaptHD and OnlineHD, support verification at a nominal trigger exposure of 1% with at most 0.58 percentage points of mean accuracy loss, whereas single-pass Vanilla HDC requires greater exposure and can incur substantial accuracy costs. The error-driven models retain verification under native continued training, but extraction produces surrogates that reproduce much of the task behavior without verifiable watermarks. Watermark overwriting readily embeds attacker watermarks into HDC prototypes and erodes the owner's watermark more strongly than in the neural network references, although the strongest erosion coincides with large accuracy losses. We further deploy watermarked AdaptHD on an FPGA and stress its execution through undervolting and overclocking. Verification survives substantial computation errors, whereas more severe stress either causes verification failure together with accuracy collapse or results in inference timeouts. These findings establish the feasibility of watermarking in HDC while identifying limitations in retention under extraction and sensitivity to overwriting.
Hamed Poursiami, Farshad Soleiman, Ahmad Tahmasivand +5
1Electrical and Computer Engineering Department, George Mason University, Fairfax, VA, USA · 2Oak Ridge National Laboratory, Oak Ridge, TN, USA
LLM fingerprinting via watermark distillation embeds a statistical watermark signal into model weights, enabling model owners to identify their models behind black-box APIs. Revisiting a recent protocol, we find that its utility evaluation understates text quality degradation in open-ended generation, favoring overly strong watermark teachers. Weakening the watermark improves text quality but sacrifices detectability. To move beyond this trade-off, we rethink whether text watermarks designed for verifying generated text are suitable distillation teachers for model fingerprinting. Such watermarks are typically designed to remain detectable from an individual output, limiting how sparse the watermark signal can be. In contrast, fingerprint verification can aggregate signal across queries, making sparser watermark signals viable. This raises a key question: where should the sparse signal be placed? We analyze signal placement through token surprisal and show that, even at comparable watermark strength, different placements can target tokens with different plausibility under the base model. This motivates near-tie restriction, which uses top-1-relative logit gaps to restrict the watermark bias to tokens close to the base model's top prediction. Across multiple models, near-tie improves detection--quality frontiers under deployment changes, preserves higher text quality across query budgets, and further improves existing watermarking schemes when combined with them.
Jeongyeon Hwang, Anshul Nasery, Sewoong Oh +1
Pohang University of Science and Technology · University of Washington